ports-mgmt/pkg 2.8.4

ports-mgmt/pkg: update to 2.8.4

Changes:
- fix 2 corner case null pointer deref

ports-mgmt/pkg: update to 2.8.3

Fix use after free, causing a crash on some upgrades

Reported by:	flo

ports-mgmt/pkg: update to 2.8.2

Changes:
- lots of security improvements
- repo: keep file lists out of the data catalog
- rwhich: store filesite as a compressed archive locally.
- rwhich add global and per repository configuration of the file
  database
- fix deferred rc script execution
- fix duplicated reinstall reason
- fix UAF in additional SAT cycle
- fix SRV/HTTP mirror handling
- respect compression level for file database and metadata

ports-mgmt/pkg: Fix UAF during additional SAT cycle

Reported by:	dch
Reviewed by:	dch, kevans
Differential Revision:	https://reviews.freebsd.org/D58486

ports-mgmt/pkg: update to 2.8.1

Changes:
- fix: non-root reads of a WAL-mode database with missing sidecars
- fix: leftover parent @dir directories on deinstall
- fix: static build with -pie
- macho: map macOS 26 / iOS 19 to Darwin 25
- api: add PKG_EVENT_PKG_FETCH_BEGIN for per-package fetch progress
- fix: missing space in a libpkg error message

ports-mgmt/pkg: fix a regression in db access

Reported by:	vvd

ports-mgmt/pkg: update to 2.8.0

Major Changes:
==============

Database & performance
- better read/write concurrency on the local DB
- Schema bumped to v42: 15 redundant single-column indexes dropped, flavors VIEW added, shlib_id indexes added
- Read-only databases opened with SQLITE_OPEN_READONLY, falling back to immutable=1
- Binary repositories: 16K pages and synchronous=OFF during bulk catalog updates
- Implicit SQL-89 JOINs converted to explicit JOIN syntax, several queries optimized
- Some database concurrency issues fixed

New features
- pkg-checksum(8): new command to generate and validate checksums
- Blake2b used everywhere possible for checksums; repositories use blake2 instead of sha256
- rwhich: file tracking and search for remote repositories (requires repositories to be built with -l)
- pkg delete -G/--exclude-glob: exclude packages by glob pattern
- Repositories: enable/disable/reset support
- pkg autoremove -qn: quiet, script-friendly output
- pkg query: %{...} falls back to pkg_printf(3) evaluation
- lua: pkg.exec_capture -- captures stdout/stderr of pkg.exec
- plist: @for ... @end loops and # comments
- Triggers: per-file instead of per-directory
- RC script support rewritten to be safer
- DECOMPRESSION_THREADS respected when decompressing
- Arbitrary data can be stored in the repository meta file
- OSVf updated to official JSON schema 1.7.5 with CVE name parsing and osv_type for VuXML compatibility
- Periodic script for dependency checking
- CheriBSD and CheriABI OS/ABI declared

Minor Changes:
==============

- Handle getgrnam_r/getpwnam_r upon ERANGE
- Replace system() with execlp() for man page display
- query_select no longer discards valid input on EOF without newline
- Handle trailing %% in printf format strings
- input validation hardened via fuzzing
- which: always show the matched path
- info -e: only return 0 if all packages on the command line exist
- install: respect -q
- upgrade: do not propose downgrades to solve provides/requires
- upgrade: clarified messages for missing packages and changes
- fetch: respect RFC 3986
- lock: do not error in expected (un)lock state
- shlibs: also remove ignored shlibs provided from shlibs required
- backup_libraries: atomic replacement, fully respects rootdir
- backup_lib: prevent accumulating old libs and badly matching them
- DB: loudly complain if the DB cannot be opened
- DB: in case of remote DB corruption, destroy it to allow rebuilding
- Repo: do not delete repositories in overrides, simply disable them
- Honor --repository flag for disabled repos as documented
- search: improved error message and fixed multiple JSON formatted results
- update: warn when trying to update a non-existent repository
- fingerprints: fallback on the host to find them when using -r
- libelf: fix Linux/powerpc64 build
- libecc: support Linux/ppc64
- pkg-which: fix spurious warning message with -p
- extract: prefer mtime from manifest over archive
- periodic: daily checksum is now off by default
- plug multiple memory leaks and resource leaks

Dependency updates
- SQLite 3.53.2
- Lua 5.4.8
- libucl 0.9.5

PR:	296292
exp-run: antoine

ports-mgmt/pkg: update to 2.7.5

Changes:
- backup lib: loudly complain if a library is not in filesystem but in plist
- backup lib: fix with rootdir
- progress: avoid useless newlines
- config: accept more boolean types
- fix fflags support

ports-mgmt/pkg: better with distinfo

ports-mgmt/pkg: update to 2.7.4

- repo: do not delete repositories in overrides, simply disable them
- query: fix %y/%Y
- Declare CheriBSD and CheriABI OS and ABI

ports-mgmt/pkg: Release 2.7.3

Fix an nasty bug where pkg could request to downgrade itself
in pkgbase environement

ports-mgmt/pkg: update to 2.7.2

Changes:
- multiple fixes on per package triggers
- fetch now normalize the URLs
- ease porting to downstream OS

ports-mgmt/pkg: update to 2.7.1

Major Changes:
- install: respect -q
- vital: now explicitly state the SAT solver issue are due to a vital package
- lua: add pkg.exec_capture, a pkg.exec version capturing stdout/stderr
- Honor --repository flag for disabled repos as documented
Other Changes:
- version: add IGNORE_MAJOR to pkg.conf and document it
- pkg_config: accept int as boolean converted via != 0
- lock: do not error in expected (un)lock state
- backup_libraries: now fully respects rootdir
- backup libraries: atomic replacement of the library
- DB: loudly complain if the DB cannot be opened
- shlibs: also remove ignored shlibs provided from shlibs required

ports-mgmt/pkg: update to 2.7.0

Changes:
* switch back to libfetch (curl support has been removed)
* triggers: add per-package triggers, with new `pkg_upgrade` variable, documented in triggers(5)
* install: accept `http://`, `https://` and `file://` URLs to install packages directly
* install: small behaviour change — `install -A` no longer marks upgraded/reinstalled packages as automatic
* autoremove: install, delete and upgrade are now autoremove aware
* solver: avoid spurious reinstall from wrong repo with multi-repo setups,
* solver: fix extra reinstallations,
* solver prevent rdeps discovery explosion
* search: add `search -S comment-description`
* search: add `ssh_args` per repository configuration
* query: add `%y` and `%Y` formats for provides/requires
* backup libraries: change the default behaviour 1 package per library now.
* add: resolve shlibs and provides via symlink directory layout, ignore dead symlinks for provides/requires
* add: really analyse the content of `.a` archives
* updating: support glob patterns in user-provided port names
* lots of documentation updates.
* info: `--raw` now exports valid JSON for multiple packages
* delete: fix `-fR`
* set: `-n` never matches the first argument vs origin anymore
* DB: add missing indexes
* DB: only attempt schema upgrade when DB is opened RW
* upgrade: fix yet another endless upgrade loop of pkg
* upgrade: attempt config file merge for force install
* libpkg: fix `--register-only` with empty packages and to populate config file contents
* libpkg: fix `getgrnam_r` related errors
* libpkg: actually export the `pkg_set_ignore_osversion` symbol
* add: skip osversion check when force is set
* add: remove existing file before renaming temp directory (pkg_add)
* fetch: properly terminate on SIGINT during fetch
* search: fix handling when search returns multiple JSON formatted results
* query: do not print empty line for purely multiline formats; print an empty line for multiline if no information to display
* install: emit a message when trying to install `-f` a locked package
* jobs: honor `PKG_FLAG_DRY_RUN` in `pkg_jobs_execute()`
* jobs: before scheduling a DELETE job verify if it is really needed
* solver: always process rdeps for remote packages
* db: only open the db readonly when write is not needed
* sandbox: provide a default handler for `PKG_EVENT_SANDBOX_GET_STRING`
* EVENT_PIPE: fix invalid JSON
* signal handling: multiple fixes
* fix crash when using external merge tool
* securelevel: check for bsd securelevel and report errors
* fflags: test if we are running in a jail and report errors
* sign_pkg.sh: use the `.pkg` extension
* 400.status-pkg: provide an option to select the source to check
* Fix overlinking on macOS
* pkg: messages improvements, wording fixes
* extensive code cleanup, deduplication and factorization.
* added many new tests (audit, delete, info, which, autoremove order, multi-repo solver, install behaviour change, link flags)

ports-mgmt/pkg: Export the pkg_set_ignore_osversion symbol

PR:		293767
Approved by:	bapt (via IRC)
Pull Request:	https://github.com/freebsd/freebsd-ports/pull/493

ports-mgmt/pkg: update to 2.6.2

Changes:
- register: properly close the database
- fix an issue which make some installed packages temporary invisible
  to the non root users (regression from the WAL introduction)
- fix the json for info --raw --raw-format json when requested on multiple
  packages

ports-mgmt/pkg: update to 2.6.1

- fix regression in pkg delete -f: it should always ignore rdeps

ports-mgmt/pkg: update to 2.6.0

Major Changes

* create: use -t to specify the timestamp for the manifest file.
* fetch: add -s/--sumlink option for mirror mode
* triggers: only defer triggers when the need to execute an external program
* db: enable WAL mode for local databases
* query: add support for query evaluation of complex attributes
* libpkg: store ignored shlibs in manifest and db
* libpkg: respect ignred shlibs for BACKUP_LIBRARIES
* drastically reduce memory usage for all operations
* fix reproducible build issue
* autoremove: fix deletion order
* lots of documentation updates

Other Changes

* use C23 __has_include to reduce configure checks
* fix issue hiding the unit in progress bar
* if for anyreason the extraction rename failed, keep the file around with a .pkgnew suffix
* plenty of fixes in the upgrade decision process
* plenty of corner cases crash fixed
* prevent fetching a file twice

ports-mgmt/pkg: update to 2.5.1

Changes from 2.5.0 to 2.5.1
- Regression: fix directory permission when @mode is used in plist
- use the timestamp provided by -t for manifest timestamp
- improvements in documentation
- slight inprovements in the progress bar:
  * counters are now always aligned
  * when possible only print name-version for the package being fetched.
  * add a space in the debit

ports-mgmt/pkg: update to 2.5.0

Major Changes
-  unregister: new command to remove the records from an installed package
-  while keeping the files around
-  install: new --register-only: record the package as installed without touching
-  anyfiles on the filesystem
-  case sensitivity: lots of changes: now the behaviour is conistent accross all
-  commands and respect the default setting in pkg.conf

Other Changes:
- update curl to 8.17.0
- update sqlite to 3.51.1
- fetch: many imrpovements in debug output
- set a sane default mode for empty directory in plist
- improve the error message when not deleting a package due to a lock or a vital flag

ports-mgmt/pkg: Fix stage-qa warning and sort PLIST

- Strip shared library and binary executable
- Sort PLIST
- Bump PORTREVISION for package change

====> Running Q/A tests (stage-qa)
Warning: 'lib/libpkg.so.4' is not stripped consider trying INSTALL_TARGET=install-strip or using ${STRIP_CMD}
Warning: 'sbin/pkg-static' is not stripped consider trying INSTALL_TARGET=install-strip or using ${STRIP_CMD}
Warning: 'sbin/pkg' is not stripped consider trying INSTALL_TARGET=install-strip or using ${STRIP_CMD}

PR:		290600
Approved by:	bapt

ports-mgmt/pkg: update to 2.4.2

Changes:
- fix a progress bar issue with pkg check -s -a

PR:	290807

ports-mgmt/pkg: update to 2.4.1

Changes from 2.4.0 to 2.4.1
- Fix 32bit regression
- cleanup trigger(5) manpage
- fix a crash during 3 way merge

Changes form 2.3.0 to 2.4.0
- Use line buffering for the metalog file handle
- Fix bug making pkg delete too many directories in case of split upgrades
- BACKUP_LIBRARIES now create one backup package per source package
- new metalog_copy lua function to create entries in the metalog cloning metadata
  from another file
- New OSVF Parser
- New CPE Parser/Emitter
- Lots of code cleanup and simplification
- Add support for system triggers (triggers in /usr/share/pkg/triggers)
- pkg check now respects -r (rootdir)
- relax ABI checking
- Lots of improvements and bugs fixes regaring BACKUP_LIBRARIES features
- Integrate BACKUP_LIBRARIES in the solver
- Add vital flag to the list of flag which we need to consider for package reinstallation
- tack uname, gname, mtime, permissions and fflags in the db and in the manifest
  instead of relying on the tar informations. which gives us pkg check -m to check for
  for metadata changes.
- METALOG: add entries for intermediate directories
- better 404 reporting
- fix return code for pkg upgrade -n
- new pkg sets alias example in default pkg.conf
- new DEBUG_SCHEDULER_DOT_FILE option to generate a graphviz DOT format for the job graph
- loosen ordering for upgrade jobs (reduces a lot the number of split upgrades and speed up
  the scheduler on setup with large number of packages.)

Pr:	290659
Exp-run: antoine

ports-mgmt/pkg: Backport bug fix needed for 15.0

This adds a patch (7ea9566835a82f111d7771f58168babc5e0dde6a) which
fixes a release-build-breaking bug in pkg(8).  It is now in the pkg
repository but the 15.0 release process can't wait for a new pkg
release to happen so I'm pulling the bug fix in here instead.

With hat:	re@
Reviewed by:	kevans
Differential Revision:	https://reviews.freebsd.org/D53310

ports-mgmt/pkg: udpate to 2.3.1

Changes:
- fix shlib(8) input validation
- micro optimize upgrade candidate checking
- internal cleanup

ports-mgmt/pkg: update to 2.3.0

Major changes

    improve reproducible build support
    scripts now support METALOG
    set(8): allow to bulk "partial replacement"
    rework the scheduler to minimize the number of split upgrades
    add(8): backout support for provides/requiress

Other changes

    update sqlite 3.50.4
    update curl 3.16.0
    fix fetch resuming
    shlib(8): now accept full patch
    stats(8): only show local db
    run pkg delete script even during split upgrades)
    back libraries during split upgrades if needed
    repositories: allow negative priorities
    upgrade: when pkg self restart: do not warn about the env vars.
    fetch(8): do not crash on invalid url
    many documentation fixes

PR:		289269
exp-run:	antoine

ports-mgmt/pkg: Update to 2.2.2

Changes:
- Set numeric uid/gid when adding archive entries
- Provide the METALOG path to pkg scripts
- Run script even for split upgrade

Sponsored by:	Beckhoff Automation GmbH & Co. KG

ports-mgmt/pkg: update to 2.2.1

Changes:
- revert the scheduler "fixes" trying to reduce the
  number of "split upgrades", it causes ordering issues
- plug some leaks
- fix some sqlite statement leak

ports-mgmt/pkg: update to 2.2.0

Major changes:
- Fix new solver over splitting upgrades
- Fix multi repository priority decision during installation
- Use a cache file during pkg_add execution for provides/requires
- Lots of internal rework to improve performances on low ressources machines
- Update bundled code to their latest version

PR:		287293
Exp-run:	antoine

ports-mgmt/pkg: update to 2.1.4

Changes:
- fix crashes on 32bits architectures

ports-mgmt/pkg: update to 2.1.3

More work on pkg add performances
Fix symbols collision between libmd and libcrypto

PR:		286832
Exp-run:	Antoine

ports-mgmt/pkg: update to 2.1.2

Changes:
- fix an important regression introduced in 2.1.1
- more performance improvement on pkg add

Because of a bad merge between the main and the release branch of pkg
some commits were missed and a regression was introduced in pkg 2.1.1

It results in some packages dependending on themselves which breaks
early the various bulks.

Those packages built with 2.1.1 needs to be recreated with 2.1.2

PR:		286130

ports-mgmt/pkg: update to 2.1.1

Changes from 2.1.0 to 2.1.1
- fix cases where upgrade detection was missed
- improvement performances for pkg add (aka poudriere build time as
  well)

PR: 		286130
Exp-run:	antoine

ports-mgmt/pkg: update to 2.1.0

/!\ Committer visible changes /!\
in poudriere and system using pkg add, pkg will verify that provides
requires (including for shlibs) are satisfied, which meaning it can now
stop stating a missing required dependency is missing, which up to now
where happening unnoticed!

Major changes:

* pkg add: now supports shlibs and regular provides/requires
* info -r and -d now shows shlibs and regular provides/requires
* new --script-no-exec: which makes pkg dies if a script attempt to exec an
  external binary

Other changes:

* improve VITAL flag handling
* upgrade libcurl to latest version
* fix pkg bootstrap -y
* libpkg: allow non interactive way to set IGNORE\_OSVERSION
* lots of internal bug fixes
* fix progress

PR:		285325
Exp-run:	antoine

ports-mgmt/pkg: update to 2.0.6

Changes:
- sort list before exporting manifest to improve reproducibility
- only track shared libraries which starts with lib*
- ignore compat32 libraries on systems installed from sets (vs pkgbase) where
  the lib32 set is not installed.
- update: now works again on system with less than 300MB of RAM available

ports-mgmt/pkg: remove not necessary powerpc64le knob

ports-mgmt/pkg: udpate to 2.0.5

Changes from 2.0.4 to 2.0.5
- Allow ABI_FILE in pkg.conf(5)
- fix crash in case of conflicts
- restore flexibility for end user to replace directories with symlinks to
  directories
- Do not track absolute DT_NEEDED (really this time)
- curl: more verbose error message

ports-mgmt/pkg: update to 2.0.4

- Fix an issue preventing pkg to fetch some packages in case of multiple
  iteration of the solvers
- Do not track DT_NEEDED libs which are registered with full path

ports-mgmt/pkg: update to 2.0.3

Changes:
- Improve elf format detection
- Remove debugging printf

ports-mgmt/pkg: update to 2.0.2

Relax OSVERSION requirement

ports-mgmt/pkg: update to 2.0.1

Changes:
- fix pkg version
- fix pkg check -d
- logs of improvements in the solver to avoid extra reinstallation on
  systems without pkgbase

ports-mgmt/pkg: update to 2.0.0

- rework scheduler entirely (Sponsored by the FreeBSD Foundation)
- add support for using an external tool for 3 way merge (Sponsored by Serenity Cyber Security, LLC)
- great improvement in portability: now pkg on any OS supported OS can deal with packages built for any supported OS
- pkg now tracks shlibs with tagging:  (Sponsored by the FreeBSD Foundation)
   libfoo.so.1.0.0          - native (no change to status quo)
   libfoo.so.1.0.0:32       - compat 32
   libfoo.so.1.0.0:Linux    - compat Linux
   libfoo.so.1.0.0:Linux:32 - compat Linux 32
- pkg tracks 32bit compat shlibs     (Sponsored by the FreeBSD Foundation)
- pkg can track linux shlibs for linux compatibility (disabled by default) via  TRACK_LINUX_COMPAT_SHLIBS
- new SHLIB_REQUIRE_IGNORE_GLOB and SHLIB_REQUIRE_IGNORE_REGEX to filter out some libraries to be added to shlibs_required list
- ALTABI is not used anymore at all and is considered deprecated, only ABI is considered
- MACHO support has been entirely rewritten
- pkg now tracks libraries for the base system on FreeBSD in both pkgbase and non pkgbase setup

- upgrade bundled libs to latest version
- -r now always enable the repository mentioned
- transaction summary: removed packages are listed at the bottom
- curl: add support for HTTP_PROXY_AUTH
- compression: allow defining the number of threads used for zstd and xz compression
- check -B and -r options have been removed
- improved granularity of the debug information
- audit: add -d to allow audit packages in a specified directory
- fix case sensitivity support for glob searches
- check: default on -s
- fetch vuxml over https by default
- repositories: new subcommand to list repositories
- plenty of fixes in file:// parsing in urls
- repo: speed up repository creation
- fix plenty of memory leaks

**Full Changelog**: https://github.com/freebsd/pkg/compare/1.21.3...2.0.0

ports-mgmt/pkg: update to 1.21.3

Fix periodic script on current

ports-mgmt/pkg: Remove pre-everything target

It displays messages related to conversion from ancient pkg_* tools to
pkg. But support of the former ended with FreeBSD 9 and ports
framework doesn't support them either.

Reviewed by:	bapt
Differential Revision:	https://reviews.freebsd.org/D44902

ports-mgmt/pkg: release 1.21.2

Changes:
- fix database path handling for rootdir
- revert a change in vital/lock handling in the solver cause
  some vital packages to never be upgraded.

ports-mgmt/pkg: udpate to 1.21.1

Changes:
- fix a regression regarding HANDLE_RC_SCRIPTS option
- fix the processing entries spinner

ports-mgmt/pkg: update to 1.21.0

Changes since latest 1.20.0
- new event PKG_EVENT_PKG_ERRNO
- add: only generates .pkgsave when really needed
- repo:
  * remove the ability to create v1 repository format
  * remove ability to produce meta.{pkg,txz} unused since 1.13
  * replace packagesite.pkg with data.pkg (new extensible format)
  * keep producing packagesite.pkg for backward compatibility
  * local repository information is now located in
    /var/dbv/repos/<reponame/*
- support job cancellation (packagekit support)
- update bundle code to latest versions:
  * libcurl
  * sqlite
  * lua
  * libucl
- plist keywords:
  - new @override_prefix
  - new @var key value (able to expand %%key%%)
- scripts:
  * new variable PKG_ISCHROOTED for script to be aware if being run
    bia pkg -c
- update:
  * prevents concurrent pkg update to compete
- pkgbase:
  * .snap now comes after .alpha in versionning
- key:
  * new subcommand to be able to generate signature keys
- signatures:
  * add support ECDSA and EdDSA for all its signature mechanism
- elfhints:
  * pkg now supports elfhints of any byte-order on FreeBSD
- solver:
  * prevent directly in the solver the ability to remove vital or
    locked packages

PR:		277978
Exp-run:	antoine

ports-mgmt/pkg: move manpage to share/man

ports-mgmt/pkg: update to 1.20.9

Changes:
- fix a race in vuln.xml udpate trigger
- undocument ftp support
- curl: add backward compatibility with libfetch on HTTP_USER_AGENT
- new Keyword: @override_prefix (pkgbase)
- only generate .pkgsave files when really needed

ports-mgmt/pkg: update to 1.20.8

Changes:
- update curl to 8.4.0
- check: document -n
- manuals: smalls fixes
- fix database transaction leak